I know we can grab the user's session ID in apex by using UserInfo.getSessionID() but what limitations are there as to what rest endpoints it can use and also is there any way for me externally to verify the token as to whether it is a valid token and the username/userid of the token.
1 Answer
The Session ID is limited to whatever the parent session is limited to. For example, using the REST API, you'd have access to whatever APIs are within the scope
of the OAuth session that was authorized, while in Lightning, you'd be limited to just the UI API
methods, as the Lightning Session ID doesn't include REST or SOAP API access.
-
-
this is more so I can run tests and see what scopes I get from what. Apr 19, 2022 at 13:35
-
@KarlLivesey the only properties in aware of are in the Auth session object. You do get to know what kind of session you're using, but not specific properties like the OAuth scope, which is only relevant for OAuth login flows. You have to basically call the API and see what response you get.– sfdcfoxApr 19, 2022 at 13:52